Description:
Malicious web applications could use expression language to bypass the
protections of a Security Manager as expressions were evaluated within
a privileged code section.
This issue only affects installations that run web applications from
untrusted sources.

Mitigation:
Users of affected versions should apply one of the following mitigations
- - Upgrade to Apache Tomcat 8.0.17 or later
(8.0.16 has the fix but was not released)
- - Upgrade to Apache Tomcat 7.0.59 or later
(7.0.58 has the fix but was not released)
- - Upgrade to Apache Tomcat 6.0.44 or later